From 36bd9a7fa8630ffc2a32f1cad3256ee5ab77acda Mon Sep 17 00:00:00 2001
From: Alexander Cooper <alcooper@chromium.org>
Date: Mon, 20 Jul 2026 22:31:50 -0700
Subject: [PATCH] [WebXR] Detect all frame owners in DOM Overlay

ProcessOverlayHitTest downcasts the hit element to HTMLFrameElementBase
to decide whether to walk the content frame subtree for cross-origin
content. That base class only covers <iframe> and <frame>; content
embedded via <object>, <embed>, or <fencedframe> owns a content frame
through HTMLFrameOwnerElement instead, so the cast returned null and
the cross-origin check was skipped.

Cast to HTMLFrameOwnerElement instead so every frame-owning element is
subject to the same origin check. Extend the ar_dom_overlay WPT with
an <object> variant of the existing cross-origin iframe test.

TAG=agy

Fixed: 524418836
Change-Id: I43830c7a669820dbb56c3a1792d9f7c6813d1c1e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8120459
Reviewed-by: Brian Sheedy <bsheedy@chromium.org>
Commit-Queue: Alexander Cooper <alcooper@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1665189}
---
 webxr/dom-overlay/ar_dom_overlay.https.html | 25 +++++++++++++++------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/webxr/dom-overlay/ar_dom_overlay.https.html b/webxr/dom-overlay/ar_dom_overlay.https.html
index 250adf9b246b25..00d5da9a1379a1 100644
--- a/webxr/dom-overlay/ar_dom_overlay.https.html
+++ b/webxr/dom-overlay/ar_dom_overlay.https.html
@@ -11,7 +11,7 @@
       min-width: 10px;
       min-height: 10px;
   }
-  iframe {
+  iframe, object {
     border: 0;
     width: 20px;
     height: 20px;
@@ -25,6 +25,9 @@
   <!-- This SVG iframe is treated as cross-origin content. -->
   <iframe id="iframe" src='data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><rect height="20" width="20" fill="red" fill-opacity="0.3"/></svg>'>
   </iframe>
+  <!-- This SVG object is treated as cross-origin content. -->
+  <object id="object" data='data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><rect height="20" width="20" fill="blue" fill-opacity="0.3"/></svg>' type="image/svg+xml">
+  </object>
   <canvas>
   </canvas>
 </div>
@@ -175,11 +178,11 @@
   return eventPromise;
 };
 
-let testCrossOriginContent = function(overlayElement, session, fakeDeviceController, t) {
+let testCrossOriginContent = function(elementId, overlayElement, session, fakeDeviceController, t) {
   let debug = xr_debug.bind(this, 'testCrossOriginContent');
 
-  let iframe = document.getElementById('iframe');
-  assert_true(iframe != null);
+  let element = document.getElementById(elementId);
+  assert_true(element != null);
   let inner_b = document.getElementById('inner_b');
   assert_true(inner_b != null);
 
@@ -198,8 +201,8 @@
     // Press the primary input button and then release it a short time later.
     requestSkipAnimationFrame(session, (time, xrFrame) => {
       debug('got rAF 1');
-      input_source.setOverlayPointerPosition(iframe.offsetLeft + 1,
-                                             iframe.offsetTop + 1);
+      input_source.setOverlayPointerPosition(element.offsetLeft + 1,
+                                             element.offsetTop + 1);
       input_source.startSelection();
 
       session.requestAnimationFrame((time, xrFrame) => {
@@ -289,7 +292,15 @@
 
 xr_session_promise_test(
   "Ensures DOM Overlay interactions on cross origin iframe are ignored",
-  testCrossOriginContent.bind(this, document.getElementById('div_overlay')),
+  testCrossOriginContent.bind(this, 'iframe', document.getElementById('div_overlay')),
+  fakeDeviceInitParams, 'immersive-ar', {
+    requiredFeatures: ['dom-overlay'],
+    domOverlay: { root: document.getElementById('div_overlay') }
+  });
+
+xr_session_promise_test(
+  "Ensures DOM Overlay interactions on cross origin object are ignored",
+  testCrossOriginContent.bind(this, 'object', document.getElementById('div_overlay')),
   fakeDeviceInitParams, 'immersive-ar', {
     requiredFeatures: ['dom-overlay'],
     domOverlay: { root: document.getElementById('div_overlay') }